Hi,
I am after upgrade to graylog 4.0, and have some troubles exporting logs to CSV, because of changes in API since 2.x. The problem is how to use " in query. In GUI I am able to search logs with: action:tunnel-down AND logdesc:“SSL VPN tunnel down”, unfortunately it doesn’t work with API: “query_string”: { “type”:“elasticsearch”, “query_string”:“action:tunnel-down AND logdesc:“SSL VPN tunnel down”” }. As " is special case in API syntax, I am facing this error: Unexpected character (‘S’ (code 83)): was expecting comma to separate Object entries.
When I am testing query in API browser, then this: logdesc:“SSL VPN tunnel down”" gives desired output, but not in with curl in console.
How to resolve this?
Best regards
logdesc:\“SSL VPN tunnel down\”" did the trick, topic can be closed.
1 Like
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.